1

We are using spring ws as a filter to perform WS-Security based on Token, timestamp and signature on the incoming soap request.

We wants to prevent the XXE attack using the same filter and wondering if its possible.

We're using 'org.springframework.ws.soap.axiom.AxiomSoapMessageFactory' as a messageFactory and it has two setters 'setSupportingExternalEntities' & 'setReplacingEntityReferences' which are by default false.

<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///c:/windows/win.ini"> ]>

Now if a entity is decalared using doctype in soap request and it is referred using &xxe; then spring framework throws back an error

org.apache.axiom.soap.SOAPProcessingException: A SOAP message cannot contain entity references because it must not have a DTD
2018-05-18T13:14:33,272 DEBUG [org.springframework.ws.soap.server.SoapMessageDispatcher] Endpoint invocation resulted in exception - responding with Fault
org.apache.axiom.soap.SOAPProcessingException: A SOAP message cannot contain entity references because it must not have a DTD
    at org.apache.axiom.soap.impl.builder.StAXSOAPModelBuilder.createEntityReference(StAXSOAPModelBuilder.java:359) ~[axiom-api-1.2.15.jar:1.2.15]
    at org.apache.axiom.om.impl.builder.StAXOMBuilder.next(StAXOMBuilder.java:279) ~[axiom-api-1.2.15.jar:1.2.15]

But then this error does not come if we replace &name; with &amp ;xxe; or &#38 xxe; Spring ws framework let it go through.

I don't want it to go through to any further processing so may be if possible we can somehow don't allow doctype declaration itself in the soap request.

thanks for any help and pointer(s) to resolve this

sonu131
  • 157
  • 1
  • 11

1 Answers1

1

Adding how I got it resolved. Did not find a way to handle it in the spring-ws filter and Spring was not mis-behaving as it was not trying ti resolve the passed entity.

Later in the flow in our project, we're using standard java DOM parser lib and by adding

factory.setFeature(DISALLOW_DOCTYPE_DECL_FEATURE, true);

we were able to stop the DTD declaration which resolved the XXE issue.

sonu131
  • 157
  • 1
  • 11